CVE-2026-84696 in PS3111-S11 Controller
Summary
by MITRE • 09/02/2026
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The Phison PS3111-S11 solid-state drive controller firmware versions up through SBFQT1.3 contain a critical security flaw related to the exposure of privileged vendor unique commands over the standard ATA interface. This architectural oversight allows attackers with physical access or low-level software privileges to interact directly with the storage controller's internal management functions, bypassing normal user-facing operations. The vulnerability stems from an inadequate authentication mechanism designed to protect these sensitive administrative commands, which are intended for factory use and maintenance rather than general end-user interaction. By exploiting this weakness, malicious actors can gain unauthorized access to low-level hardware controls that should remain isolated from external interfaces.
The core technical flaw lies in the implementation of the unlock handshake process used to authorize vendor unique command execution. The authentication mechanism relies heavily on a weak CRC-16 checksum for validation purposes rather than robust cryptographic verification or multi-factor authorization protocols. This design choice creates a trivial bypass vector, as attackers can easily reverse-engineer and replicate valid challenge-response sequences due to the limited entropy of the 16-bit cyclic redundancy check. In some firmware builds, this protection is entirely absent, leaving vendor unique commands completely unprotected against unauthorized invocation. The absence or weakness of these controls means that any entity capable of sending ATA commands to the drive can potentially escalate privileges to execute restricted operations without detection or prevention by standard security mechanisms.
Exploitation of this vulnerability enables attackers to read and write directly to controller memory and raw flash storage sectors, effectively bypassing all higher-level file system protections and encryption layers implemented at the operating system level. This capability allows for the persistence of malicious implants that survive power cycles, reboots, and even standard formatting operations because they reside in areas typically reserved for firmware or bad block management tables. Once implanted, these persistent threats can facilitate data exfiltration, credential harvesting, or serve as a foothold for further network intrusion attempts. The ability to manipulate raw flash memory also opens the door to modifying drive metadata, potentially leading to integrity violations and reliability issues that compromise the trustworthiness of stored data.
From an industry standards perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-359 Exposure of Private Information Through Sensory Output if sensitive data is read out via diagnostic commands. It also maps to MITRE ATT&CK techniques such as T1074 Data Staged for Exfiltration or T1565 Stored Data Manipulation, where attackers modify stored information to maintain access or disrupt operations. The lack of secure boot validation and weak authentication mechanisms further relate to CWE-327 Use of a Broken or Risky Cryptographic Algorithm when considering the CRC-16 implementation as an insufficient security control for privileged command authorization.
Mitigation strategies must prioritize immediate firmware updates provided by Phison that address these authentication deficiencies, ensuring that vendor unique commands are either disabled in production builds or protected with strong cryptographic challenges and responses. Organizations relying on drives equipped with this controller should assess their physical access controls to prevent unauthorized hardware interaction during maintenance windows. Additionally implementing strict ATA command filtering at the host bus adapter level can help block suspicious sequences targeting privileged interfaces before they reach the storage device. Long-term resilience requires adopting storage solutions that enforce secure boot processes and validate firmware integrity using digital signatures, thereby preventing the execution of unverified or maliciously modified controller code even if low-level access is attempted.